CVE-2026-56330
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
50/100
Published: 2026-06-20
Modified: 2026-11-08
First seen: 2026-11-08
Status: active
Attack Surface
Network
Low Complexity
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
Active
AT:
None
VC:
Low
VI:
None
VA:
None
Description
Capgo before 12.128.2 contains an open redirect vulnerability in stripe_portal and stripe_checkout endpoints that accept unvalidated callbackUrl, successUrl, and cancelUrl parameters. Authenticated attackers can craft malicious billing URLs to redirect users to attacker-controlled domains for phishing and credential harvesting.
Weakness Classification (1)
References & Advisories (2)
vendor-advisory
third-party-advisory